Fresh sites get a high-severity Dependabot alert: css_parser < 3.0.0 pinned by jekyll-3rd-party-libraries

## What happens

Every site created from the current template gets a high-severity Dependabot alert as soon as it is pushed to a public GitHub repository. `Gemfile.lock` resolves `css_parser` to 1.22.0, which is affected by GHSA-9pmc-p236-855h / CVE-2026-53727 (SSRF and local file disclosure in `CssParser::Parser#read_remote_file`). The fix is in css_parser 3.0.0, released 2026-06-01.

Bundler cannot move to it. `jekyll-3rd-party-libraries` 0.0.1, the only version on rubygems.org, declares `css_parser (>= 1.6, < 2.0)`, and the template's `Gemfile` also lists `css_parser` directly. So `bundle update css_parser` stays on 1.x, and Dependabot cannot open a fix PR either.

## To reproduce

1. Create a site from the template, run `bundle install`, commit `Gemfile.lock`.
2. Push to a public repository with Dependabot alerts enabled (the default).
3. Within minutes, Security > Dependabot shows the alert on `Gemfile.lock`.

## Impact

Low in practice: the gem runs only during the build, on the site's own CSS, and the published site is static. But it hits every al-folio user on GitHub, and there is nothing they can do about it on their side. Related history: #3609 bumped css_parser to 1.22.0.

## Suggested fix

Relax the constraint in `jekyll-3rd-party-libraries` to allow css_parser 3.x and publish a new version, then refresh `Gemfile.lock` in the template. I can test a pre-release of the plugin against a site built from the current template and report back.